[trissim]

Goal standby, closed-wait recovery, terminal-turn release and completed-reply settlement decoded saved replies while holding the registry’s exclusive lock. A worker thread still kept every other registry user waiting for that same lock.

Reply review now runs outside EX through the existing action preparation hook and a shared GoalWaitReview publication context. It retains the actual held bus cut and captured owner, goal, exact wait, turn and dependency state. Publication preserves observed input-row validation, rechecks the original RegistryOwner fence, and clears only the exact recorded wait. Real replies arriving after review remain eligible. Notices are re-read outside EX; unrelated recipients, titles and renames do not veto publication. No global revision veto, second action runner, cache, persisted snapshot or producer.

Review corrections at a43f3f8:

1. IDEN-6: goal_waits.py:266 captures RecordedThreadIncarnation via snapshot.threads_for. goal_management.py:174 accepts the held Thread; terminal release and reply consumption retain the incarnation. The name round-trip is deleted.
2. BOUND-7: bus.py:389 owns public received_after. It calls the existing ReceivedSource.exists query for one indexed existence result. goal_waits.py:317 calls the public method. BusReader is untouched; no private sequence helper or Use message owners for heartbeat liveness and reply eligibility #2630 API remains.
3. IMPL-12: thread_identity.py:420 declares ThreadAuthority; registry_document.py:889 derives it. same_authority at :879 and owner_restart.py:84 compare that same value. The restart handoff carries it; codec and consumer tests are migrated. Thread.same_turn remains shared with RegistryTurnRule.
4. tests/test_reservation_rules.py:27 supplies NativeSessionFiles and its actual bus-owned proof path. Its real looping-symlink case exposed an uncaught OSError; session_revision.py:69 now returns the existing unavailable observation for stat failures instead of leaking that error.
5. tests/test_goal_reply_lock_scope.py:201 parametrizes mutation functions. The string switches are deleted. Its probe at :42 opens the lock separately and tries flock LOCK_NB directly, with a known-held-lock control. No subprocess or Python source embedded in strings.

Independent-main result: CLEAN. The five implementation commits are based directly on main 2cb721d; no #2630 commit is an ancestor. The first experiment exposed an accidental dependency on its private _received_sequences helper; using the existing typed-table existence query removed that dependency. #2638 targets main and lands independently. The temporary remote next/goal-reply-lock-main is deleted; origin next/goal-reply-lock-scope equals a43f3f8.

Validation:

• The required test_goal_reply_lock_scope.py passes all 24 cases on main without Use message owners for heartbeat liveness and reply eligibility #2630. Together with exact-wait selection, restart handoff and repaired session tests: 40 passed in 4.20s.
• Capture/revalidation now queries just the exact goal wait rather than decoding the entire wait store. The existing wait-store test retains its prohibition on full reads and checks that only the selected goal is decoded, allowing the necessary capture/revalidation reads.
• Both authoritative local debt-src and debt-tools pass against main 2cb721d at the exact head a43f3f8, workers=1. Evidence: /home/ts/.cache/agent-scratch/goal-lock-main-debt-{src,tools}.txt.
• Two broader tests fail identically on untouched main: test_goal_input_review.py::test_inspected_canonical_dependencies_allow_standby_without_replay expects the retired goal_execution.state field; test_l0_goal_input_closure.py::test_unknown_reason_survives_real_history_without_inventing_provenance creates a goal without launch authority. The baseline control is retained at /home/ts/.cache/agent-scratch/goal-lock-main-baseline-tests.txt. These are not hidden as a clean broader batch.
• Canonical NRA before/after census: 473 production/dependency modules; 4,882 to 4,885 original classes, every original joined to the canonical family projection, zero unprojected classes or parse omissions. Before uses Git-main source overlays. Lexical method matches include unrelated receivers; arbitrary dynamic binding remains unresolved. Source relationships are not equivalence proof. Receipts: /home/ts/.cache/agent-scratch/commander-control-plane/goal-reply-lock-main-source-{before,after}.json.

Assumed: Linux flock semantics; ordinary production bus publication retains its existing shared registry lock through append; the installation owner performs affected installed/native qualification. No additional live run, input replay or latency claim is included.

Original 269-site receipt preserved byte-for-byte at goal-read-publication-source.json. Comparable lexical-anchor refresh at goal-read-publication-source-after.json follows those original selected sites on this independent-main head: 464 source modules, 257 matched current sites, 15 unmatched baseline records and 3 ambiguity records. Missing/moved/repeated anchors stay OPEN; this is neither a debt score nor a binding proof. New ownership declarations/calls remain in the complete main-source-after receipt. Generated with the supplied main Python3.14 + mi-source-deps/NRA overlays, original ModuleSyntaxIndex and node-index enclosing_function_name, without dependency installation.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.